v5.5 Installation Guide

Transcription

1 v5.5 Installation Guide for use with Integrated Microsoft Products

2 Websense Enterprise Installation Guide , Websense, Inc Sorrento Valley Rd., San Diego, CA 92121, USA All rights reserved. Published April 4, 2005 Printed in the United States of America NP MSPISA This document may not, in whole or in part, be copied, photocopied, reproduced, translated, or reduced to any electronic medium or machine-readable form without prior consent in writing from Websense, Inc. Every effort has been made to ensure the accuracy of this manual. However, Websense, Inc., makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Websense, Inc. shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice. Trademarks Websense and Websense Enterprise are registered trademarks of Websense, Inc. in the United States and certain international markets. Websense has numerous other unregistered trademarks in the United States and internationally. All other trademarks are the property of their respective owners. Microsoft, Windows, Windows NT, and Windows Server are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Sun, Solaris, UltraSPARC, Sun Java System, and all Sun Java System based trademarks and logos are trademarks or registered trademarks of Sun Microsystems, Inc., in the United States and other countries. Red Hat is a registered trademark of Red Hat, Inc., in the United States and other countries. Linux is a trademark of Linus Torvalds in the United States and other countries. Novell, Novell Directory Services, and edirectory are trademarks or registered trademarks of Novell, Inc., in the United States and other countries. Netscape and Netscape Navigator are registered trademarks of Netscape Communications Corporation in the U.S. and other countries. Pentium is a registered trademark of Intel Corporation. Apple, Macintosh, Mac, and Mac OS are trademarks of Apple Computer, Inc., registered in the U.S. and other countries. Safari is a trademark of Apple Computer, Inc. This product includes software developed by the Apache Software Foundation ( Other product names mentioned in this manual may be trademarks or registered trademarks of their respective companies and are the sole property of their respective manufacturers. WinPcap Copyright (c) NetGroup, Politecnico di Torino (Italy) All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. Neither the name of the Politecnico di Torino nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

3 Contents Chapter 1 Introduction How Websense Works Deployment Tasks Documentation Feedback Chapter 2 Network Configuration Websense Enterprise Components Websense Deployment Single Microsoft Proxy or ISA Server Configuration Array Configuration Switched Environments NAT and Network Agent Deployment Directory Services System Requirements External Resources Supported Microsoft Integration Product Versions Typical Windows Installation Solaris Patches Websense Enterprise Manager Windows Solaris User Workstations Macintosh Support Novell Clients Chapter 3 Upgrading Websense Enterprise Versions Supported Transferring Configuration Data Without Upgrading Before You Upgrade Integrated Microsoft Products 3

4 Contents Upgrading Websense Enterprise Converting a Stand-Alone System to an Integrated System All Components on the Same Machine Distributed Components Upgrading to the Stand-Alone Edition Windows Converting to an Integrated System Windows Migrating Between Integrations After an Upgrade Changing IP Addresses of Installed Components Chapter 4 Installation Before Installing Installing Websense on the Microsoft Integration Machine Installing Websense Enterprise on a Separate Machine Installing the Websense ISAPI Filter Installing Websense Enterprise Components Separately Windows Procedures Websense Enterprise Manager Network Agent DC Agent Real-Time Analyzer (RTA) RADIUS Agent edirectory Agent Logon Agent Solaris and Linux Procedures Websense Enterprise Manager Network Agent RADIUS Agent edirectory Agent Modifying an Installation Adding Components Windows Solaris or Linux Removing Components Windows Solaris or Linux Websense Enterprise

5 Contents Repairing an Installation Windows Solaris or Linux Repairing the Policy Server Migrating between Integrations After Installation Stopping or Starting Websense Services Manually Stopping Services Optional Components Principal Components Windows Solaris and Linux Chapter 5 Initial Setup Subscription Key and Database Download Identifying the Filtering Service for the Block Page URL Displaying Protocol Block Messages Creating and Running the Script for Logon Agent Prerequisites for Running the Logon Script File Location Deployment Tasks Preparing the Logon Script Script Parameters Websense User Map and the Persistent Mode Examples Configuring the Logon Script to Run Active Directory Windows NTLM Identifying the Proxy Server for the Network Agent Configuring Firewalls or Routers WinSOCK and SOCKS Proxy Servers Configuring for ISA 2004 Using the Firewall Client Workstation Configuration Microsoft IIS Services Chapter 6 Authentication Microsoft ISA Server Integrated Microsoft Products 5

6 Contents Firewall and SecureNAT Clients Web Proxy Clients Authentication Methods Basic Authentication Digest Authentication Integrated Windows Authentication Client Certificate Authentication Microsoft Proxy Server Anonymous Authentication Basic Authentication Windows NT Challenge/Response and Integrated Windows Authentication About Transparent Identification Chapter 7 Event Publisher Installing Event Publisher Integrating Event Publisher with IBM Tivoli Tivoli Enterprise Console (TEC) Tivoli Risk Manager Appendix A Stealth Mode Configuring for Stealth Mode Windows Solaris or Linux Solaris Linux Appendix B Troubleshooting I made a mistake during installation I forgot my Websense Policy Server password Where can I find download and error messages? Windows 2000 and The Master Database does not download Subscription Key Internet Access Restriction Applications Websense Enterprise

7 Contents Policy Server fails to install Network Agent fails to start with stealth mode NIC IP address removed from Linux configuration file Stealth mode NIC selected for Websense communications in Linux and Solaris Network Agent is not filtering or logging accurately Windows 9x workstations are not being filtered as expected Some users are receiving the Websense Global policy Domain Controller Visibility NetBIOS User Profile Issues Websense Enterprise splash screen is displayed, but installer does not launch on Windows Websense filtering is interrupted when Microsoft ISA 2000 Server crashes Determining the Virtual Memory Allotment Adjusting the ISA Server Cache Size Percentage Opening results in an authentication prompt Network Agent cannot communicate with Filtering Service after it has been reinstalled Appendix C Technical Support Websense Technical Services Support Center Fee-based Support Support Options Web Portal Questions Telephone Assistance Improving Documentation Index Integrated Microsoft Products 7

8 Contents 8 Websense Enterprise

9 CHAPTER 1 Introduction Thank you for choosing Websense Enterprise, the leading Employee Internet Management system that integrates with Microsoft Internet Security and Acceleration (ISA) Server and Microsoft Proxy Server. Using Websense in conjunction with an integrated Microsoft product provides you with a highly effective Internet filtering service. Websense gives network administrators in business, education, government, and other enterprises the ability to monitor and control network traffic to Internet sites. In the business setting, Websense Enterprise is an invaluable tool for minimizing employee downtime due to Internet surfing that is not work related. In addition, Websense helps control the misuse of network resources and the threat of potential legal action due to inappropriate access. Websense, Inc. strongly recommends that your users be informed of your organization s policies concerning Internet access, and that Websense Enterprise has been installed as a tool for monitoring activity and/or enforcing your Internet use policies. The following is a list of Websense Enterprise components: Filtering Service: interacts with Microsoft ISA Server and Microsoft Proxy Server to provide Internet filtering. Policy Server: stores all Websense Enterprise configuration information and communicates this data to other Websense services. User Service: allows you to apply filtering policies based on users, groups, domains and organizational units. Websense Enterprise Manager: administrative interface that communicates with the Policy Server to configure and manage the Filtering Service. Network Agent: detects HTTP network activity and instructs the Filtering Service to log this information. You must install the Network Agent and configure it properly to use the Bandwidth Optimizer, Protocol Management, IM Attachments, and enhanced reporting (bytes transferred and duration) features. Network Agent is also used as the filtering component for a stand-alone (non-integrated) system. Integrated Microsoft Products 9

10 Chapter 1: Introduction DC Agent: an optional component that transparently identifies users who authenticate through a Windows directory service. DC Agent enables Websense to filter Internet requests according to particular policies assigned to users or groups. RADIUS Agent: an optional component that works through a RADIUS Server to transparently identify users and groups who access your network using a dial-up, Virtual Private Network (VPN), Digital Subscriber Line (DSL), or other remote connections. edirectory Agent: an optional component that works together with Novell edirectory to transparently identify users so that Websense can filter them according to particular policies assigned to users or groups. Logon Agent: an optional component that works with a Websense application (LogonApp.exe) to transparently identify users as they log on to a Windows domain. Logon Agent receives its user information from an application called LogonApp.exe that must be run by a logon script in your network. Real-Time Analyzer (RTA): displays the real-time status of all the traffic filtered by Websense Enterprise. RTA graphically displays bandwidth information and shows requests by category or protocol. Event Publisher: an optional component that creates SNMP traps from the log messages that are generated by the Websense Filtering Service. These traps are then forwarded, or published, to an application that manages SNMP and used as needed. Master Database: contains a collection of millions of Internet sites, representing more than 800 million pages, each categorized by content. In addition, the Master Database contains protocols for such things as streaming media, peer-to-peer file sharing, and instant messaging. Websense Reporter: a separate program available free of charge with Websense Enterprise. Its Log Server component records Internet activity on your network. Using this log information, Reporter can generate a wide variety of reports and charts depicting your network s Internet usage trends. These reports can be used to refine Internet filtering strategies, helping to maximize network resources and employee productivity. Refer to the Websense Reporter documentation for installation and configuration procedures. Websense Explorer: a web-based application which provides a view into the Log Database. Explorer displays summary information, as well as specific detail about users Internet activity. Refer to the Websense Enterprise Explorer Administrator s Guide for installation and configuration procedures. 10 Websense Enterprise

11 Chapter 1: Introduction How Websense Works Websense Enterprise is the engine by which content filtering is enforced. With its flexible, policy-based filtering approach, Websense allows you to apply different filtering policies to different clients (users, groups, domains/ organizational units, workstations, or networks). When Microsoft ISA Server or Microsoft Proxy Server receives an Internet request from a client, it queries Websense Enterprise to find out whether the requested site should be blocked or not. To make this determination, Websense consults the policy assigned to the client. Each policy delineates specific time periods during the week and lists the category sets that are in effect during those time periods. After it determines which categories are blocked, Websense Enterprise consults its comprehensive database of Internet addresses (URLs). If the site is assigned to a blocked category, the user receives a block page instead of the requested site. If the site is assigned to a permitted category, Websense Enterprise notifies Microsoft ISA Server or Microsoft Proxy Server that the site is not blocked, and the site is returned to the user. Websense Enterprise filters network applications that use TCP-based protocols and measures bandwidth usage of UDP-based messages as well. If an initial Internet request is made with TCP, and the request is blocked by Websense Enterprise, all subsequent UDP traffic will also be blocked. UDP protocols such as RTSP and RTP are monitored and logged by Websense Enterprise. The Quota feature is an alternative to full blocking. It gives employees time each day to visit sites in categories you deem appropriate. Quotas can be a powerful tool for Internet access management. Quotas help you control how much time your employees spend on personal surfing and the types of sites they are able to access. For more information, refer to your Websense Enterprise Administrator's Guide. With the Protocol Management feature, Websense Enterprise can filter Internet protocols other than HTTP. This includes protocols, applications, or other data transfer methods such as those used for instant messaging, streaming media, file sharing, file transfer, Internet mail, and various other network or database operations. If you have purchased Bandwidth Optimizer and have installed the Network Agent, Websense Enterprise can filter Internet sites, protocols, or applications based on available network bandwidth. You can specify filtering settings to limit user access to sites, protocols, or applications based on bandwidth usage. Integrated Microsoft Products 11

12 Chapter 1: Introduction Deployment Tasks The following sequence is recommended for installing Websense Enterprise and configuring it to filter Internet traffic with Microsoft ISA Server or Microsoft Proxy Server. 1. Plan the Websense deployment: Websense components can be deployed in various combinations depending upon the size and architecture of your network. Deciding what Websense components to install and where to put them is your first task. Consult Chapter 2: Network Configuration for sample deployment options and system requirements for typical installations in a small network. If you are deploying Websense Enterprise in a network containing more than 500 users, refer to the Websense Deployment Guide. 2. Install Websense: Once you have decided how to deploy Websense on your network, you must install the selected components and perform initial setup tasks. Refer to Chapter 4: Installation for the installation procedures for each operating system. 3. Configure your browser: You must direct all Internet requests through Microsoft ISA Server or Microsoft Proxy Server. This is the last step in the installation and configuration process. Workstation browsers must be configured to use either Microsoft ISA Server or Microsoft Proxy Server to handle HTTP, HTTPS, and FTP requests. An exception to this would be for browsers in an ISA Server environment using Firewall Clients or Secure NAT Clients. Refer to your browser s documentation for setup procedures. Documentation Feedback Websense, Inc. welcomes comments and suggestions regarding the product documentation. Please send feedback to DocFeedback@websense.com. If possible, include your organization s name in your message. 12 Websense Enterprise

13 CHAPTER 2 Network Configuration Websense Enterprise components can be installed in a number of possible configurations, depending upon the nature of your network and your filtering requirements. The information in this chapter will help you determine both your hardware needs and the relationship of Websense components to one another. Websense Enterprise Components When deciding how to deploy Websense Enterprise components in your network, consider the following installation dependencies: Filtering Service: typically installed on the same machine as the Policy Server and may be installed on the same machine as the Websense Enterprise Manager. The Filtering Service installs on Windows, Solaris, and Linux. You can install a maximum of 10 Filtering Services for each Policy Server if they employ quality network connections. For additional information, refer to the Websense Enterprise Deployment Guide. Policy Server: typically installed on the same machine as the Filtering Service, but may be installed on a separate machine, depending upon the configuration of your network. There must be only one Policy Server installed for each logical installation. An example would be a Policy Server that delivers the same policies and categories to each machine in a subnet. The Policy Server installs on Windows, Solaris, and Linux. Websense Enterprise Manager: may be installed on the same machine as the Websense Filtering Service. The Websense Enterprise Manager may be installed on multiple machines in the network to enable remote configuration of the Filtering Service. The Websense Enterprise Manager may be used on a different operating system from the Filtering Service. The Websense Enterprise Manager installs on Windows and Solaris. User Service: installed in networks using a directory service for authentication. User Service is unnecessary if you intend to filter and log Internet requests based on client workstation IP addresses only. User Service can be installed on the same operating systems supported by the Integrated Microsoft Products 13

14 Chapter 2: Network Configuration Filtering Service and is typically installed on the same machine; however, you may install User Service on a different operating system than the Filtering Service. User Service installs on Windows, Solaris, and Linux. i IMPORTANT You can have only one User Service installation for each Policy Server in your network. For systems providing multilingual support, User Service produces correct results for one locale only. The locale of the Policy Server determines the language it supports for directory services. Organizations with multilingual support requirements must install the product suite (User Service, Policy Server, and the Filtering Service) for each supported language on machines configured for that language. Network Agent: can be installed on the Filtering Service machine or separately, depending upon your needs and the configuration of your network. Network Agent installs on Windows, Solaris, and Linux. When planning the deployment of the Network Agent consider the following: The Network Agent must be able to directly see 2-way Internet traffic from your internal network to filter and log effectively. Make sure your network configuration routes both the Internet request from the workstation and the response from the Internet back to the workstation past the Network Agent. For the best performance, install the Network Agent on a dedicated machine, connected to an unmanaged, unswitched hub that is located between an external router and your network. See Switched Environments, page 22 if you are installing Network Agent in a network that employs switches. For small to medium sized organizations, the Network Agent can be installed on the same server machine as the other Websense Enterprise components, assuming that the server meets the minimum system requirements. For larger organizations, you may want to put the Network Agent on a separate, dedicated server to increase the amount of traffic that can be managed. On larger networks, you may need to install multiple Network Agents and assign them to monitor various IP address ranges in your network. Make sure that the IP address ranges for each instance of the Network Agent do not overlap. This will result in double logging. Deploy the Network Agents so that they can filter the entire network. Partial deployment will result in incomplete filtering by protocol and 14 Websense Enterprise

15 Chapter 2: Network Configuration bandwidth, as well as the loss of log data from network segments not watched by the Network Agent. For instructions on defining IP address ranges for multiple Network Agents, refer to the Websense Enterprise Administrator s Guide. Avoid deploying the Network Agent across different LANs. If you install an instance of Network Agent on 192.x.x.x and configure it to communicate with a Policy Server on 10.x.x.x through a variety of switches and routers, communication may be slowed enough to prevent the Network Agent from blocking an Internet request in time. Do not install the Network Agent on a machine running any type of firewall. The Network Agent uses a packet capturing utility which may not work properly when installed on a firewall machine. Real-Time Analyzer (RTA): can be installed on the same machine as the Filtering Service or on a separate machine. The Real-Time Analyzer installs on Windows only. i IMPORTANT You can have only one installation of RTA for each Policy Server in your network. To use the RTA Web-based interface, you must have one of the following Web servers installed in your network: Apache Web Server version 2.x and later Microsoft IIS v5.0 or v6.0 NOTE If you do not have one of the supported Web servers on your system, the Websense Enterprise installer will offer you the option of installing the Apache Web Server. DC Agent: can be installed in networks using a Windows directory service (NTLM-based or Active Directory) if you are not receiving user information from your Microsoft Proxy or ISA Server. DC Agent can be installed on any Windows server in the network, either on the same machine as other Websense components, or on a different machine. DC Agent installs on Windows only. Integrated Microsoft Products 15

16 Chapter 2: Network Configuration For small to medium networks, it is recommended that you install only one DC Agent per domain. If you have a large, distributed network with many domain controllers on the same domain, you can install multiple DC Agents. Installing DC Agent on the domain controller machine is not recommended. DC Agent can be installed on any network segment as long as NetBIOS is allowed between the DC Agent and the domain controllers. Setting up the DC Agent in the DMZ is not recommended. You may install DC Agent and the RADIUS Agent together on the same machine or on separate machines in your network. DC Agent and edirectory Agent can be installed in the same network, but cannot be active at the same time. Websense Enterprise does not support communication with Windows and Novell directory services simultaneously. If DC Agent is not identifying all your users as anticipated, you may install Logon Agent as well to improve user authentication in your network. For example, this might be necessary in a network that uses Windows 98 workstations. DC Agent uses workstation polling to get user information from workstations as they make Internet requests; however, polling cannot retrieve user information from a Windows 98 workstation. If you are installing DC Agent, be sure that the machine names of any Windows 9x workstations in your network do not contain any spaces. This situation could prevent DC Agent from receiving a user name when an Internet request is made from that workstation. For detailed deployment information, refer to the white paper titled Transparent Identification of Users in Websense Enterprise found on the Websense Web site at: RADIUS Agent: can be installed on the same machine as Websense Enterprise or installed on a separate machine in your network. You may install multiple RADIUS Agents on the same network, each configured to communicate with the Filtering Service. You can install RADIUS Agent and edirectory Agent on the same machine or on separate machines in your network. For configuration information, refer to the User Identification chapter in the Websense Enterprise Administrator s Guide. The RADIUS Agent installs on Windows, Solaris, and Linux from a Custom installation only. 16 Websense Enterprise

17 Chapter 2: Network Configuration edirectory Agent: can be installed on the same machine as Websense Enterprise or installed on a separate machine in your network. You can install multiple edirectory Agents on the same network, each configured to communicate with the Filtering Service.You can install edirectory and RADIUS Agent on the same machine or on separate machines in your network. For configuration information, refer to the User Identification chapter in the Websense Enterprise Administrator s Guide. The edirectory Agent installs on Windows, Solaris, and Linux. To avoid a port conflict, do not attempt to install the edirectory Agent together with the DC Agent. Logon Agent: can be installed on the same machine as Websense Enterprise or installed on a separate machine in your network. Logon Agent may be installed together with DC Agent to improve user authentication in your network. The Logon Agent installs on Windows, Linux, and Solaris. The logon script that runs LogonApp.exe runs on Windows only. Refer to Creating and Running the Script for Logon Agent, page 167 for instructions. Websense Enterprise Reporter components: installed on a separate machine from the Filtering Service except when evaluating Websense Enterprise. The Log Server receives and saves information on Internet requests filtered by Websense Enterprise. Reporter then uses this information to create reports. See the Websense Reporter documentation for installation and administrative information. NOTE To generate reports properly, you must use the same version of Websense Enterprise and Websense Enterprise Reporter. Integrated Microsoft Products 17

18 Chapter 2: Network Configuration Websense Deployment Websense Enterprise components can be installed on a dedicated server machine as emphasized in this guide or widely distributed across a network on various operating systems. In many cases, Websense Enterprise can be installed on the same machine as your integration product, if the machine has adequate resources. Wherever you decide to deploy Websense Enterprise, make sure that the installation machine can handle the expected traffic load. The following network diagrams represent common configurations that are intended for smaller networks and are maximized for efficiency. The network architecture in this guide may not be suitable for your network, particularly if your network contains 500 or more users. For larger, distributed networks, refer to the Websense Enterprise Deployment Guide for detailed deployment recommendations. Otherwise, refer to the Websense Enterprise Components and System Requirements sections of this manual for installation guidelines when planning your deployment. When Websense Enterprise is installed on the same machine as the Microsoft Proxy or ISA Server, a Websense ISAPI Filter must be installed at the same time. The ISAPI Filter allows Microsoft Proxy or ISA Server to communicate with Websense. If Websense is installed on a separate machine, a Websense ISAPI Filter must be installed on every Microsoft Proxy or ISA Server machine in the network that must communicate with Websense. If your environment includes an array of Microsoft Proxy or ISA Server machines, the preferred configuration is to install Websense on a machine outside the array. In environments with a large number of workstations, installing multiple instances of Filtering Service for load balancing purposes may be appropriate. Some load balancing configurations, however, permit the same user to be filtered by different Filtering Services, depending on the current load. For instructions on how to configure Websense for multiple Filtering Service installations, refer to the Websense Enterprise Administrator s Guide. Do not install Websense Enterprise and Websense Enterprise Reporter together on the same machine or on a machine running a firewall. Filtering and logging functions are CPU intensive and could cause serious operating system errors. Install Websense Enterprise and Websense Enterprise Reporter on separate machines inside the network, where they will not have to compete for resources. The exception to this is when Websense Enterprise is being evaluated on a small network or segment of a larger network. 18 Websense Enterprise

19 Single Microsoft Proxy or ISA Server Configuration Chapter 2: Network Configuration The following diagram shows all the Websense Enterprise components, with the Websense ISAPI Filter, and Microsoft Proxy or ISA Server running on the same machine. Unless the Internet traffic volume is light, this configuration requires a powerful machine. Filtering Service Installed with Microsoft Proxy or ISA Server An alternate setup places the Websense Enterprise Components and Websense Enterprise Manager together on a machine separate from the Microsoft Proxy or ISA Server machine. In this case, the Websense ISAPI Filter must be installed on the Microsoft Proxy or ISA Server machine so that it can communicate with Websense. The following diagram shows this alternate setup. Integrated Microsoft Products 19

20 Chapter 2: Network Configuration Filtering Service Installed Separately from Microsoft Proxy or ISA Server This configuration eases the load on the Microsoft Proxy or ISA Server machine by placing all the Websense Enterprise components on a separate machine. The Websense Filtering Service and Microsoft Proxy or ISA Server machine must be able to communicate over the network in this setup. Websense Enterprise Manager can also be installed on multiple machines for added flexibility. The Log Server, which is installed with Websense Reporter on a separate machine from Websense, receives and saves information on Internet requests filtered by Websense. See your Websense Enterprise Reporter documentation for more information. NOTE Websense Enterprise v5.5 sends log information that can only be read by Websense Enterprise Reporter v5.5. Therefore, you must install or upgrade to Reporter v5.5 in order to generate reports. 20 Websense Enterprise

21 Array Configuration Chapter 2: Network Configuration Websense Enterprise is compatible with most array configurations, including Cache Array Routing Protocol (CARP) arrays. If the Microsoft Proxy or ISA Server machines in the array can run Websense Enterprise without a loss of performance, installing all the Websense components on one of the array machines is recommended. In this configuration, the two applications will not have to communicate over the network. Remember to install the Websense ISAPI Filter on each Microsoft Proxy or ISA Server machine in the array. The following diagram shows Websense Enterprise components running on a Microsoft Proxy or ISA Server machine, with the Websense Enterprise Manager installed on a workstation machine. Array Configuration #1 If there is a potential loss of performance by installing the Websense Enterprise components on the Microsoft Proxy or ISA Server machine, the recommendation is to install Websense Enterprise on a separate machine outside the array, and then install the Websense ISAPI Filter on each member of the array. When Websense is installed in this manner, all array members Integrated Microsoft Products 21

22 Chapter 2: Network Configuration send Internet requests to the Filtering Service that is installed outside the array. Array Configuration Other configurations are possible. Consult your Microsoft Proxy or ISA Server documentation for information about Microsoft Proxy and ISA Server configurations. Switched Environments In a switched environment, configure a switch to use mirroring or 2-way port spanning, so that the Network Agent can detect Internet requests from all the workstations. NOTE Contact your switch vendor to determine if your switch is capable of mirroring or port spanning and to learn how to implement the correct configuration. The following network diagrams represent the logical relationship of network elements in a switched environment and are not intended to reflect the actual deployment of Websense Enterprise with your Microsoft integration product. 22 Websense Enterprise

23 Chapter 2: Network Configuration Basic Deployment in a Switched Environment Integrated Microsoft Products 23

24 Chapter 2: Network Configuration Switched Environment with a Remote Office Connection On a large network, you may need to install multiple Network Agents and assign them to monitor various IP address ranges in your network. If you install multiple Network Agents, consider the following: Do not assign overlapping IP address ranges. If the IP ranges overlap, network bandwidth measurements will not be accurate, and bandwidthbased filtering will not be applied correctly. 24 Websense Enterprise

25 Chapter 2: Network Configuration Deploy the Network Agents so that they can filter the entire network. Partial deployment will result in incomplete filtering by protocol and bandwidth, as well as the loss of log data from network segments not watched by the Network Agent. Multiple Network Agents in a Switched Environment Integrated Microsoft Products 25

26 Chapter 2: Network Configuration NAT and Network Agent Deployment The use of Network Address Translation (NAT) on internal routers can prevent the Network Agent from identifying the source IP addresses of client machines making Internet requests. If you are deploying the Network Agent to monitor traffic from multiple subnets after it passes through such a router, you must disable NAT, or the Network Agent will see the IP address of the router s external interface as the source of the request. An alternative would be to install the Network Agent on a machine located between the NAT router and the clients to be monitored. Directory Services If your environment includes a directory service, you may also assign different policies to individual users or groups with accounts in that directory service. Websense can communicate with the following directory services: Windows NTLM-based directories Windows Active Directory Sun Java System Directory Server v4.2 and v5.2 Novell Directory Services/eDirectory v8.51, v8.6, and v8.7 installed on a Windows or NetWare operating system For information about configuring directory service access, see your Websense Enterprise Administrator s Guide. NOTE Websense Enterprise can communicate with your directory service whether it runs on the same operating system as Websense or on a different system. In most cases, the DC Agent or edirectory Agent are not necessary for authentication when Websense Enterprise is integrated with Microsoft Proxy Server or ISA Server. Only if your Microsoft integration product is unable to return user information, will it be necessary to install and configure one of these transparent identification agents. Filtering can be based on individual user, group, and domain/organizational unit policies, providing that Websense is able to identify the user making an Internet request. The authentication method you configure must allow Filtering Service to obtain directory object information from a Windows or 26 Websense Enterprise

27 Chapter 2: Network Configuration LDAP directory. For information about accessing LDAP and Windows directories, see the Websense Enterprise Administrator s Guide. Internet requests can be filtered based on policies assigned to individual directory objects after the following tasks have been accomplished: If you are using the Sun Java System Directory Service or Novell directory service: 1. Enable the appropriate directory service within Websense. 2. Enable Websense to identify users transparently with Novell by installing and configuring the Websense edirectory Agent. 3. Enable Websense manual authentication so that Websense can identify users. If you are using a Windows NTLM-based directory or Active Directory, and your Microsoft integration product is not sending user information to Websense Enterprise: 1. Configure the Windows directory service within Websense. 2. Enable Websense to identify users transparently by installing and configuring the Websense DC Agent or the edirectory Agent. 3. Enable manual authentication within Websense so that if Websense is unable to identify users transparently, it will prompt users to manually authenticate. For information about Websense manual authentication, see the Websense Enterprise Administrator s Guide. Websense Enterprise can transparently identify users in a Windows domain if the Websense DC Agent is installed on a Windows 2000 or 2003 Server in the network. In networks using a Novell directory service you can transparently identify users by installing the Websense edirectory Agent. The Websense transparent identification feature allows Websense to filter Internet requests from users identified in a Window or Novell directory service without prompting them to authenticate manually. Once the Websense Filtering Service is configured to communicate with the transparent identification agent (DC Agent or the edirectory Agent), the agent obtains user information from the directory service and sends the information to the Filtering Service. When the Filtering Service receives the IP address of a machine making an Internet request, the Filtering Service matches the address with the corresponding user name provided by the transparent identification agent. This allows Websense to transparently identify users whenever they open a browser that sends an Internet request to the Microsoft Integrated Microsoft Products 27

28 Chapter 2: Network Configuration Proxy Server or ISA Server. For information about transparent identification and the Websense DC Agent or the edirectory Agent, please see the Websense Enterprise Administrator s Guide. System Requirements The following recommended system requirements are for a typical Websense Enterprise installation in a small network, in which all components are installed on the same machine. Separate requirements are provided for the Websense Enterprise Manager only, which is often installed on an administrator s machine for convenience. All components, with the exception of the ISAPI Filter, can run on the same Windows machine or can be distributed on separate Windows, Solaris, or Linux machines. Websense Enterprise components can be installed on machines with the same or different operating systems. For system requirements and deployment recommendations not covered in this guide, refer to the Websense Enterprise Deployment Guide. Such factors as network size, network configuration, and Internet traffic volume can affect the ability of Websense Enterprise to filter Internet requests. If you plan to install Websense Enterprise on a machine that has high CPU demands, make sure that the machine has sufficient resources to accommodate all the software loaded on it. The recommended system requirements listed here may not provide enough speed or memory for Websense Enterprise to function correctly on a busy network if it is forced to compete for resources. External Resources Websense Enterprise relies on certain external resources to function properly in your network. Make sure that the following network elements can adequately support the filtering efforts of Websense Enterprise. TCP/IP: Websense Enterprise supports TCP/IP-based networks only. If your network uses both TCP/IP and non-tcp protocols, only those users on the TCP/IP portion of your network will be filtered by Websense Enterprise. DNS server: If IP addresses are not sent to the Websense Filtering Service together with a URL request, a DNS server can be used to resolve the URL into an IP address. Websense Enterprise or your integration product (where applicable) require efficient DNS performance. Make sure 28 Websense Enterprise

29 Chapter 2: Network Configuration your DNS servers are fast enough to support Websense Enterprise filtering without becoming overloaded. Directory services: The Websense Filtering Service can be configured with policies based on user and group names. The Filtering Service queries the directory service to identify users and their associated groups as specified in a policy. Although these users and group relationships are cached by Websense, directory service machines must have the resources to rebuild the cache rapidly when the Websense Filtering Service requests user information. Network efficiency: Connectivity to resources such as DNS and directory services is critical to the Websense Filtering Service. Network latency must be minimized if the Filtering Service is to perform efficiently. Excessive delays under high load circumstances can affect the performance of the Filtering Service and may cause lapses in filtering. Make sure your network is configured for efficient communication between Websense Enterprise and its external resources. Supported Microsoft Integration Product Versions Websense Enterprise v5.5 is compatible with the following Microsoft products: Integrations ISA Server 2004 ISA Server 2000 with Feature Pack 1 Proxy Server 2.0 update Clients ISA Firewall Clients Secure NAT Clients Web server: Internet Information Services (IIS) v5.0 and v6.0 Typical Windows Installation In the typical Windows installation, all the Web filtering components of Websense Enterprise may be installed on the same machine. Do not install Websense Enterprise and Websense Enterprise Reporter together on the same machine or on a machine running a firewall. Filtering and logging functions are memory intensive and should run on separate machines inside the network, where they will not have to compete for resources. Integrated Microsoft Products 29

30 Chapter 2: Network Configuration The recommended system requirements for this type of installation are as follows: Pentium 4, or greater 512 MB of RAM Operating systems Windows 2003 Server Windows 2000 Server, Service Pack 3 and higher 2 GB of free disk space NOTE You can reduce the disk space used by deleting the original installation files after installing Websense Enterprise. Solaris Patches Make sure you install the proper patch cluster on your Solaris 8 operating system before attempting to run the Websense Enterprise components installer. If you are unsure about which patches are required, run the Websense Enterprise installer and check the patch level of the installation machine when prompted. If the patch comparison utility displays an error in the patches you have installed on your machine, consult the following Sun Web site for a list of current patches for your version of Solaris. No patches are required for Solaris 9. Websense Enterprise Manager Requirements are listed separately for Windows and Solaris installations. A Websense Enterprise Manager installed on a Windows or Solaris machine can configure a Policy Server installed on a Windows, Solaris, or Linux machine. NOTE Websense Manager is not supported on Linux. Windows Pentium MB RAM (or more) 30 Websense Enterprise